Short answer: yes, on every iPhone from the iPhone XR and XS onwards, with no app, no setup and nothing switched on. On iPhone 7, 8 and X it works but takes an extra step. The longer answer is worth reading before you spend money, because the failure cases are specific and there is one design decision that makes them irrelevant.
What actually happens when someone taps
An NFC business card contains a small chip holding one thing: a web address. When an iPhone comes within a couple of centimetres, the phone's own radio field powers the chip, reads the address, and shows a notification at the top of the screen. The owner taps that notification and the card opens in Safari.
There is no pairing, no app, no permission prompt and no account. The chip has no battery, which is why a card works after years in a wallet and cannot be caught uncharged before a meeting.
The iPhone compatibility list, precisely
iPhone XR, iPhone XS and everything since. These read NFC tags in the background. The screen needs to be on and the phone unlocked, and that is the whole requirement. No app open, no setting enabled, no Control Centre trip. This covers the substantial majority of iPhones in active use.
iPhone 7, 8 and X. The hardware can read tags, but not in the background. The owner opens the NFC Tag Reader from Control Centre first, then taps. It works reliably once they do. It is not seamless, and you cannot count on a stranger knowing the control exists.
iPhone 6s and earlier. The NFC hardware in these is restricted to Apple Pay and will not read a tag at all.
On the Android side, most phones sold in the past decade include NFC and read tags automatically once it is enabled in settings, which it usually is by default on any phone that also does contactless payment. Plenty of budget handsets have no NFC hardware whatsoever, and no amount of card quality changes that.
The five ways a tap fails in the real world
Compatibility is only half the picture. These are the situations that actually come up.
The screen is off. Background tag reading needs the display on and the phone unlocked. A phone face-down on a table will not read anything. This is the single most common cause of "it didn't work" and it is solved by asking them to wake the phone.
A thick case, especially with a card holder. The read range is a couple of centimetres and a wallet case full of cards sits inside that budget. Metal cases and metal card holders are worse: they can block the field entirely.
They tapped the wrong part of the phone. The NFC antenna on an iPhone is at the top edge of the back, not the centre. Someone pressing the middle of their phone onto the card will get nothing. Touch the top of the phone to the card.
They are on an iPhone 7, 8 or X. Covered above. It works, it just needs Control Centre first, and a stranger will not do that unprompted.
The phone has no NFC at all. More common on Android than iPhone, and completely outside your control.
The design decision that makes all of this stop mattering
Print a QR code on the same card.
This is not a fallback in the apologetic sense, and it is not the cheap option. It is what makes the card usable in front of a person whose phone you know nothing about. In practice the exchange goes one of two ways: either they tap, or you say "or just scan it" and point at the QR. Both open the same profile, both end with your contact saved, and neither requires you to interrogate somebody about their handset model in the middle of a meeting.
A card that works on some phones is not a business card. Any NFC card sold without a QR code on it has optimised for the demo rather than for the meeting.
Is it safe?
Yes, and it is worth being able to answer this crisply, because people do ask.
The chip in a business card is read-only in normal use and stores a web address and nothing else. It carries no payment credential. It holds no personal data, because the details live on the page the address points at. It cannot read anything off the phone that touches it: the exchange is one-directional, the phone asks and the chip answers with a link.
The two-centimetre range is the security model rather than a limitation. A tag cannot be read from across a room, from a passing car, or by somebody standing behind you in a queue. Physical proximity is the consent, and iOS makes it explicit anyway by showing a notification the owner has to tap rather than opening anything automatically.
Is it worth buying?
For some people, clearly. For everyone in your company, no.
NFC earns its price where the volume of exchanges is high and the moment is short: exhibition stands, reception desks, field sales, and senior representation where the card is doing signalling work as well as carrying data. In those settings a tap is genuinely faster than anything else available, and the impression it makes is real.
It does not earn its price as a company-wide rollout. The digital card behind it is free and unlimited, so give that to everybody, print ordinary cards for the people who need paper in formal settings, and buy chips for the handful of staff who will actually use them daily.
One more consideration that matters more than it sounds: check whether the card can be reprogrammed. A card welded to one person's profile becomes rubbish the day they resign. A re-pointable one gets reassigned to their replacement, and the physical card outlives the employment.
The summary
Every iPhone since 2018 taps with no setup. Older ones need one extra step. Some Android phones cannot do it at all. Print the QR code, buy chips only for the people who tap constantly, and make sure the card can be re-pointed later.
More on NFC business cards, or the plain definition of NFC in English and Arabic.